Skip to content

Commit

Permalink
[RAC,Security Solution]Update alerts mappings to ECS 1.12 (elastic#11…
Browse files Browse the repository at this point in the history
…8812)

* Update output directory for generative script

These files were moved in elastic#98935 but the script has become out of date.

* Update ECS fieldmap with ECS 1.12

This fieldmap was missing fields from ECS 1.11+. Notable ommissions were
the threat.indicator and threat.enrichments fieldsets.

* Remove non-additive mappings changes

These are incompatible with the current alerts framework.

* Add only necessary threat fields for CTI features

This could probably be pared down further, as most of these fields are
not critical for CTI features. Additionally, these additions now exceed
the limit of 1000 fields and is causing an error in the ruleRegistry
bootstrapping.

* Remove file.pe threat fields

* Remove geo threat indicator fields

* Remove all threat.indicator mappings

These are not relevant for alerts, which will only have enrichments.

* increments index mappings total fields limit to 1200

Co-authored-by: Ece Ozalp <ozale272@newschool.edu>
Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
  • Loading branch information
3 people committed Nov 29, 2021
1 parent b605837 commit f1ea21c
Show file tree
Hide file tree
Showing 3 changed files with 422 additions and 2 deletions.
Loading

0 comments on commit f1ea21c

Please sign in to comment.